Image file names need to be encrypted or randomized

[HarrisonHall1]

The way canvas handles filenames allows for cheating in exams and quizzes. An uploaded filename is not changed by canvas, and this results in the option for a student to view the file in a separate tab, inspect html, or use a browser extension to view the file name by hovering over it.

If the filename is the answer, such as in an identification quiz, the student can easily cheat without getting caught. To get around this, instructors should rename files before submitting, however this is a glaring problem that could be addressed by canvas via a few easy changes:

• Encrypting filenames. This could even have a key that allows instructors to see the original name, but users could only see the encrypted name.
• Random file name. Upon uploading a file, it could be assigned a random name. There are many algorithms available that could insure that the name is always unique.
• Disable the option for users to inspect or right click during quizzes or exams. This is not foolproof, it can easily be circumvented, but it would require more steps to cheat.
  
  I've reported this problem to Canvas in the past, and it was never addressed. Instructors beware, your students can easily cheat, and canvas could easily patch this problem.

[TiffanyStull]

Preventing students from opening content in new tabs can be an accessibility issue for some students with disabilities.  For example, a visually-impaired student may need to open an image in a new tab to try to zoom in on it better and see it.

If a "disable right-click" or "disable opening images in new tabs" setting is implemented, there needs to be a way to also allow exceptions to it for students who need the option for accessibility (similar to how date/time limit accommodations work for exams).

I would also strongly recommend that instructors name images in exams without the answers in them.  For example, "Figure1.png" or "Question1-optionA.jpg".

[HarrisonHall1]

@TiffanyStull That is a fair rebuttal to that solution.

So why aren't names randomized or encrypted?

[TiffanyStull]

I think it would be nice to offer an option to randomize or mask the file names. For example, having an "Encrypt file name on upload" checkbox, not checked by default, available when you embed an image via the editor.

In most cases, renaming files randomly would be problematic. Meaningful file names can greatly improve accessibility and discoverability for readers/those who download them.  For example, if on upload "Syllabus.docx" (the name of which makes the file's contents clear) randomized to become something like "a93ce865b344.docx", I would have no way to locate that file either in a course's Files or after downloading it, unless I noticed that its name was a random ID and I had to edit it on saving.

[HarrisonHall1]

@TiffanyStull A checkbox to encrypt name on upload seems like a great idea to me. If that was implemented, perhaps there could be a step when creating a quiz that has an opt-in checkbox to encrypt filenames in the quiz.

Then instructors could leave things unencrypted until the time of creating the quiz to save them from having to memorize the hexadecimals when creating a new quiz.

That could also leave the option for professors to create intentionally misleading names to catch cheaters, as one professor I've mentioned this to, has decided to do.

[TiffanyStull]

@HarrisonHall1 ooh, I really like the idea of making it a quiz question option as opposed to a file setting!  I think it should be a per-question checkbox option rather than a per-quiz option, because there could be many valid use cases for having encrypted files attached in some questions and unencrypted files in others.

For example, an instructor might have a quiz that includes the following two questions:

• An image identification question where they want the image filename encrypted,
• A file upload type essay question, where they want students to download a Word document with questions, answer the questions, save the file with a particular naming convention (e.g., "StudentOne-Essay1.docx"), and upload the file back. For this second question, they might want the file attachment to be named something like "YourName-Essay1.docx" to provide a template for the student to save the file.

[TiffanyStull]

@HarrisonHall1 I made a rough mock-up (below) using a screenshot of a matching question in "New Quizzes".  I imagine the proposed checkbox would only be available to the instructor under Options if at least one image were embedded or file attached in the question.

[HarrisonHall1]

@TiffanyStull That mockup is absolutely perfect! That solves the issue I think as well!

[ProductPanda]

Comments from Instructure

As part of the new Ideas & Themes process, all ideas in Idea Conversations were reviewed by the Product Team. Any Idea that was associated with an identified theme was moved to the new Idea & Themes space. Any Idea that was not part of the move is being marked as Archived. This will preserve the history of the conversations while also letting Community members know that Instructure will not explore the request at this time.